Skip to main content

Apple finally expands its bug bounty program to accept MacOS bugs

Apple’s 3-year-old bug bounty program has finally, officially expanded to accept bug submissions from other Apple ecosystem platforms, including MacOS. The technology company announced its plans for the expansion just a few months ago, during the Black Hat cybersecurity conference. Apple appears to have launched the expansion of its Security Bounty program on Thursday, December 19, via a new webpage published on its site that provides further details on the updated program.

The Apple Security Bounty program is essentially a program in which Apple incentivizes security researchers to find bugs in Apple’s various operating systems and report them to the company in exchange for a pretty sizable monetary reward. As ZDNet notes, when the program was first launched in 2016, it only accepted bug reports for iOS bugs from certain researchers who had been invited to participate in the program. But as of this week, the Security Bounty program has officially expanded to not only accept MacOS bugs, but also bugs from other Apple operating systems, and it now allows the participation of all security researchers.

Related Videos

The newly published webpage on Apple’s website provides details on the current iteration of the Security Bounty program, including eligibility guidelines, bounty categories (and their associated maximum rewards), and instructions on how to submit a bug report. There’s even a separate page that lists example payouts for different kinds of bugs.

In addition to MacOS bugs, the program officially accepts bug reports for iOS, iPadOS, tvOS, and WatchOS. There doesn’t appear to be any MacOS specific-guidelines for submitting bug reports about it, but generally speaking, in order to be eligible for a bounty, researchers must follow three main guidelines:

  1. You have to be the first one to report the bug to Apple Product Security.
  2. A report must be submitted and it should be “clear” and contain “a working exploit.”
  3. You can’t publicize the bug until “Apple releases the security advisory for the report.”

It’s also worth noting that if the bug has “significant impact to users,” Apple will still take it into consideration for a bounty payment even if it doesn’t “fit the published bounty categories.” Also, the bounties themselves aren’t tiny. In fact, the smallest example payout listed was $25,000 and the largest payout appears to be $1 million.

Editors' Recommendations

This devious scam app proves that Macs aren’t bulletproof
A close-up of a MacBook illuminated under neon lights.

Pirated software can cause all kinds of headaches, but Mac users might have thought themselves largely immune thanks to Apple’s reputation for solid security. Yet, that complacency could prove quite problematic, as a new strain of nearly undetectable malware has shown.

According to research from security firm Jamf Threat Labs, pirated versions of Apple’s Final Cut Pro moviemaking app have been modified to contain cryptojacking payloads. When installed, the app starts using your Mac to mine the Monero cryptocurrency behind your back, potentially slowing down your machine as system resources are illegitimately gobbled up.

Read more
Microsoft is already expanding Bing Chat to Skype and phones
Microsoft Edge browser showing Bing Chat on an iPhone.

Bing Chat, the AI chatbot powered by ChatGPT, is one of Microsoft's most exciting products, and the Windows developer is wasting no time in incorporating artificial intelligence into more of its products, including three of its mobile apps: Skype, Bing mobile, and Edge.

Microsoft announced the news in a blog post this morning. The Edge browser and the Bing app are obvious choices for adding AI-enhanced search, and early access users will begin seeing Bing Chat in those apps soon. We'd seen hints about Bing Chat on mobile, just two days ago, so Microsoft is moving quickly.

Read more
This major Apple bug could let hackers steal your photos and wipe your device
A physical lock placed on a keyboard to represent a locked keyboard.

Apple’s macOS and iOS are often considered to be more secure than their rivals, but that doesn’t make them invulnerable. One security team recently proved that by showing how hackers could exploit Apple’s systems to access your messages, location data, and photos -- and even wipe your device entirely.

The discoveries were published on the blog of security research firm Trellix, and will be of major concern to iOS and macOS users alike, since the vulnerabilities can be exploited on both operating systems. Trellix explains that Apple patched the exploits in macOS 13.2 and iOS 16.3, which were released in January 2023, so you should update your devices as soon as you can.

Read more